💻 computer science

HE-CloudML: A Privacy-Preserving Framework for Secure Machine Learning Inference over Encrypted Cloud Data Using Homomorphic Encryption

This paper introduces HE-CloudML, a privacy-preserving framework that enables secure and efficient deep neural network inference on encrypted cloud data using Homomorphic Encryption, achieving near-plaintext accuracy with significant latency improvements over existing solutions while ensuring robust resistance against various privacy attacks.

Original authors: Abdullahi Ahmed Abdirahman, Abdirahman Osman Hashi, Ubaid Mohamed Dahir, Mohamed Abdirahman Elmi

Published 2026-06-25

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Abdullahi Ahmed Abdirahman, Abdirahman Osman Hashi, Ubaid Mohamed Dahir, Mohamed Abdirahman Elmi

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a very sensitive secret, like your medical records or your bank account details. You want to ask a super-smart computer (a cloud server) to analyze this data and give you an answer, but you are terrified that the computer might peek at your data while it's working.

Usually, to get an answer, you have to hand over your data in plain sight. HE-CloudML is a new invention that changes the rules of this game. It allows you to send your data to the cloud in a locked, unbreakable box, have the computer do all the math inside the box without ever opening it, and then send you back the answer, still locked in a box. You are the only one with the key to unlock the final result.

Here is how the paper explains this magic, broken down into simple concepts:

1. The "Magic Box" (Homomorphic Encryption)

Think of Homomorphic Encryption as a magical glove box.

The Problem: Normally, if you want a robot to sort your mail, you have to take the letters out of the envelopes. If the robot is untrustworthy, it can read your letters.
The Solution: With HE-CloudML, you put your letters inside a special, transparent but unbreakable glove box. The robot can shake the box, mix the letters around, and even count them, all while they are still inside the box. It never sees the letters. When it's done, it hands the box back to you. You open it, and the letters are sorted perfectly.

2. The Three-Part Team

The paper describes this system as a three-tier team working together:

The Client (You): You are the one holding the secret key. You put your data in the box and lock it. You are the only one who can open the final answer.
The Cloud Server (The Worker): This is the powerful computer in the cloud. It does all the heavy lifting and complex math, but it only ever touches the locked boxes. It is "honest but curious"—it follows the rules perfectly but tries its best to guess what's inside the boxes. The paper claims it learns absolutely nothing.
The Key Vault: This is a secure storage area that manages the keys. The "secret key" stays with you, while a special "work key" is given to the cloud server so it can do the math without unlocking the box.

3. Solving the "Math Problem" (Polynomial Approximations)

Deep learning (the AI doing the thinking) usually uses tricky, curved math functions (like ReLU or Sigmoid) that are hard to do inside a locked box.

The Analogy: Imagine trying to draw a perfect circle inside a grid made of only straight lines. It's impossible to get it exactly right.
The Fix: The researchers used a clever trick called Chebyshev polynomials. Instead of trying to draw the perfect curve, they approximated it using a series of straight lines that look almost exactly like the curve.
The Result: The AI can now do its thinking inside the locked box with very high accuracy. The paper tested this and found the AI was almost as smart as if it had seen the data in plain sight (only about 1-2% less accurate in the worst cases).

4. The "Batching" Trick (Doing Many Things at Once)

Doing math on one locked box at a time is slow.

The Analogy: Imagine a postman who can only carry one letter at a time. It would take forever to deliver 1,000 letters.
The Fix: HE-CloudML uses a technique called Ciphertext Batching. It packs hundreds of different data points into a single locked box. The cloud server does the math on all of them at the same time, like a conveyor belt processing a whole tray of cookies instead of one by one. This makes the system much faster.

5. What Did They Test?

The authors didn't just build this in theory; they tested it on three very different types of real-world data to prove it works everywhere:

Recognizing Digits (MNIST): Identifying handwritten numbers.
Recognizing Objects (CIFAR-10): Identifying things like cars, cats, and airplanes in photos.
Medical Imaging: Looking at chest X-rays to spot pneumonia.
Financial Fraud: Checking bank transactions to spot scams.

6. The Results: Fast and Private

Accuracy: The system was incredibly accurate. For example, it identified pneumonia in X-rays with 93.61% accuracy and caught financial fraud with 96.44% accuracy. This is very close to what you get when you don't use encryption.
Speed: In the past, doing this kind of math on locked data took minutes or even hours per item. The paper claims HE-CloudML is 26.9 times faster than previous methods. It can process an image in about 9 to 24 seconds, which is a huge improvement, though the authors admit it's still too slow for things that need to happen instantly (like a live video call).

7. The Catch (Limitations)

The paper is honest about the downsides:

Size: The "locked boxes" are huge. The data expands by about 1,000 times its original size. This requires a lot of computer memory (about 4.8 GB per task).
Speed: While it's 26x faster than old methods, it's still slower than just looking at the data normally. You can't use it for things that need to happen in a split second.
Trust Model: It assumes the cloud server will follow the rules (it won't try to break the box or cheat). It doesn't protect against a server that actively tries to sabotage the process.

Summary

HE-CloudML is a new framework that lets you use powerful cloud AI to analyze your most sensitive data (medical, financial, personal) without ever letting the cloud provider see the raw data. It uses a "magic box" encryption method, clever math tricks to approximate complex curves, and a "batching" system to speed things up. The paper claims it is the first system to successfully do this across medical, financial, and general image recognition tasks with high accuracy, making private cloud computing a much more realistic possibility.

Technical Summary: HE-CloudML

Problem Statement
The widespread adoption of Machine Learning as a Service (MLaaS) creates critical privacy vulnerabilities, as sensitive user data (e.g., medical records, financial transactions) must typically be transmitted in plaintext to untrusted cloud servers for inference. Existing privacy-preserving techniques have significant limitations: Differential Privacy (DP) degrades model accuracy; Federated Learning (FL) remains vulnerable to gradient inversion and does not protect data during inference; Secure Multi-Party Computation (SMPC) incurs high communication overhead; and Trusted Execution Environments (TEEs) rely on hardware trust assumptions. While Homomorphic Encryption (HE) offers a mathematically rigorous solution by allowing computation on ciphertext, existing HE-based inference systems (e.g., CryptoNets, CryptoDL) are often restricted to shallow architectures, lack support for deep neural networks (DNNs) with bootstrapping, fail to address cloud-native deployment challenges (such as key management and batching), and are rarely validated across diverse real-world domains like healthcare and finance.

Methodology
The paper proposes HE-CloudML, a unified, three-tier framework designed for secure DNN inference over encrypted cloud data using the CKKS (Cheon-Kim-Kim-Song) homomorphic encryption scheme. The architecture consists of:

Client Tier: Handles data encoding, CKKS encryption, and decryption. The client retains the secret key, ensuring raw data is never exposed.
Cloud Server Tier: Executes the inference engine entirely on ciphertexts. It is assumed to be "honest-but-curious," following the protocol correctly but attempting to infer information from inputs.
Key Vault Tier: Manages the distribution of public and evaluation keys while keeping the secret key isolated.

Key technical components include:

HE-Compatible Architecture: Non-linear activation functions (ReLU, Sigmoid) are replaced with degree-5 Chebyshev minimax polynomial approximations. MaxPool layers are substituted with strided average pooling, and Batch Normalization is absorbed into linear weights during preprocessing.
Optimized Inference Pipeline: The framework utilizes SIMD ciphertext batching (slot packing) to process multiple samples simultaneously within a single ciphertext. It employs an adaptive lazy bootstrapping strategy, invoking expensive bootstrapping operations only when the modulus chain depth falls below a specific threshold, thereby reducing latency.
Security Model: The system operates under the IND-CPA security model, grounded in the Ring Learning With Errors (RLWE) hardness assumption, providing resistance against inference, model inversion, and membership inference attacks.

Key Contributions

Unified Framework: HE-CloudML is presented as the first framework to integrate CKKS-based deep neural network inference, adaptive ciphertext batching, and cloud-native key management into a single scalable architecture.
Optimization Strategies: The paper introduces a specific pipeline combining polynomial activation approximations and adaptive modulus switching, significantly reducing homomorphic evaluation depth and latency compared to prior works.
Formal Security Analysis: A rigorous security analysis is provided under the IND-CPA model, demonstrating theoretical resistance to common cloud ML attacks without relying on trusted hardware.
Multi-Domain Validation: Unlike previous works limited to toy datasets, HE-CloudML is evaluated across three distinct domains: benchmark image classification (MNIST, CIFAR-10), medical imaging (chest X-ray), and financial fraud detection (IEEE-CIS).

Experimental Results
Experiments were conducted on an AMD EPYC 7742 server using the Microsoft SEAL library (CKKS, $N=2^{14}$ , 128-bit security).

Accuracy: HE-CloudML achieved near-plaintext accuracy across all domains with minimal degradation:
- MNIST: 99.28% (0.13% drop from baseline).
- CIFAR-10: 90.37% (1.81% drop).
- Medical Imaging: 93.61% (1.12% drop).
- Financial Fraud: 96.44% (1.18% drop).
- This represents a significant improvement over baselines like CryptoNets (77.60% on CIFAR-10) and PPCNN.
Latency: The framework demonstrated substantial speedups. On MNIST, it achieved 9.3 seconds per sample, a 26.9× improvement over CryptoNets (250s) and a 2.4× improvement over GAZELLE.
Overhead: The system incurs a memory footprint of 4.8 GB per inference pass and a ciphertext expansion ratio of approximately 1,050×. The maximum accuracy drop observed was 1.81%.
Ablation Study: The authors found that a polynomial degree of 5 offered the optimal trade-off between accuracy and multiplicative depth; increasing the degree beyond 5 yielded diminishing accuracy returns while significantly increasing computational cost.

Significance and Claims
The paper claims that HE-CloudML addresses a critical gap in the literature by providing a general-purpose, cloud-native framework that simultaneously supports deep neural network inference, CKKS encryption, and multi-domain real-world evaluation. The authors assert that this work demonstrates that strong privacy guarantees, high inference utility, and computational feasibility can be achieved simultaneously in a single architecture. By validating the framework across healthcare and financial sectors, the paper argues that HE-CloudML enables privacy-sensitive industries to adopt cloud-based AI without compromising regulatory compliance (e.g., HIPAA, GDPR) or data sovereignty.

Limitations and Future Work
The authors modestly acknowledge current limitations:

Latency: Inference times (9.3–24.6 seconds) remain too high for real-time interactive applications.
Resource Constraints: The high memory overhead (4.8 GB) limits scalability on edge devices and concurrent session handling.
Adversary Model: The framework currently only defends against semi-honest adversaries, not malicious ones.
Data Modality: Evaluation is limited to 2D and structured data, excluding complex 3D imaging or multi-modal fusion.

Future directions proposed by the authors include integrating GPU-accelerated HE libraries, employing quantization-aware training to reduce precision requirements, and extending the framework to support verifiable computation (SNARKs) for malicious adversary resistance.